Cross-site Scripting in the yoast_seo TYPO3 extension

2021-09-0118:36:44

Google

osv.dev

0.001 Low

EPSS

Percentile

22.9%

JSON

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.

CPENameOperatorVersion
yoast-seo-for-typo3/yoast_seoeq2.0.2
yoast-seo-for-typo3/yoast_seoeq6.0.0
yoast-seo-for-typo3/yoast_seoeq1.1.1
yoast-seo-for-typo3/yoast_seoeq1.1.0
yoast-seo-for-typo3/yoast_seoeq3.0.0
yoast-seo-for-typo3/yoast_seoeq1.2.0
yoast-seo-for-typo3/yoast_seoeq7.0.3
yoast-seo-for-typo3/yoast_seoeq3.0.1
yoast-seo-for-typo3/yoast_seoeq7.0.0
yoast-seo-for-typo3/yoast_seoeq1.4.0

Name	Operator	Version
yoast-seo-for-typo3/yoast_seo	eq	2.0.2
yoast-seo-for-typo3/yoast_seo	eq	6.0.0
yoast-seo-for-typo3/yoast_seo	eq	1.1.1
yoast-seo-for-typo3/yoast_seo	eq	1.1.0
yoast-seo-for-typo3/yoast_seo	eq	3.0.0
yoast-seo-for-typo3/yoast_seo	eq	1.2.0
yoast-seo-for-typo3/yoast_seo	eq	7.0.3
yoast-seo-for-typo3/yoast_seo	eq	3.0.1
yoast-seo-for-typo3/yoast_seo	eq	7.0.0
yoast-seo-for-typo3/yoast_seo	eq	1.4.0